BTCPay Server identified an attack vector in installations at version 2.4.1 or below, giving operators a defined range to check after reports involving hot wallets.
Version 2.4.1 became available July 23, 2026, the project said. It reported no credible hot-wallet theft report involving a user on version 2.4.7.
Before reporting the finding, BTCPay Server had advised operators to take their instances offline as it reviewed hot-wallet reports.
The project urged operators to install current updates. People affected could email details and logs to security@btcpayserver.org.
